{"action":"Upgrade body-parser to 1.20.6 or later.","affected":[{"fixed":"1.20.6","introduced":"0"},{"fixed":"2.3.0","introduced":"2.0.0"}],"component":"body-parser","cve_ids":["CVE-2026-12590"],"ecosystem":"npm","epss":0.00412,"exploited":false,"fixed_versions":["1.20.6","2.3.0"],"ghsa_id":"GHSA-v422-hmwv-36x6","id":"tcs_01M5KGAN8KY0YNFDJQ8GXJ5H7N","modified_at":"2026-09-10T03:50:53.014509971Z","published_at":"2026-07-20T23:23:26Z","references":["https://osv.dev/vulnerability/GHSA-v422-hmwv-36x6","https://github.com/expressjs/body-parser/security/advisories/GHSA-v422-hmwv-36x6","https://nvd.nist.gov/vuln/detail/CVE-2026-12590","https://github.com/expressjs/body-parser/pull/698","https://github.com/expressjs/body-parser/pull/741","https://github.com/expressjs/body-parser/commit/2322e111cc321413ec2b7b76d01be533d3de9d7d","https://github.com/expressjs/body-parser/commit/3492672eee593d5c158f239b6e9115498a5dbeac","https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/body-parser","https://github.com/expressjs/body-parser/releases/tag/1.20.6","https://github.com/expressjs/body-parser/releases/tag/v2.3.0"],"severity":{"label":"low","score":3.7},"sources":[{"source":"osv","source_id":"GHSA-v422-hmwv-36x6","url":"https://osv.dev/vulnerability/GHSA-v422-hmwv-36x6"}],"summary":"body-parser vulnerable to denial of service when invalid limit value silently disables size enforcement"}